5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45660

CVE-2026-45660: Statamic: Server-Side Request Forgery via Glide

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.22 and 6.18.1, the Glide image proxy's URL validation could be bypassed using an IP representation that wasn't normalized before the public-IP check. An unauthenticated user could cause the server to make HTTP requests to internal addresses — including loopback, private network, and cloud metadata endpoints. This affects sites that pass user-supplied URLs to Glide. Sites running PHP 8.3 or newer are not affected. This vulnerability is fixed in 5.73.22 and 6.18.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45660

CVE-2026-45660:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
statamic/cms	composer	< 5.73.22	5.73.22
statamic/cms	composer	>= 6.0.0-alpha.1, < 6.18.1	6.18.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, a Server-Side Request Forgery (SSRF), exists in the statamic/cms package within its Glide image processing integration. The root cause was improper validation of IP addresses in the Statamic\Imaging\RemoteUrlValidator class. Specifically, the assertPublicIp method did not account for IPv4-mapped IPv6 addresses. An attacker could provide a URL whose domain resolves to an internal IP address formatted in this way (e.g., ::ffff:127.0.0.1 for localhost). Before the patch, PHP's filter_var function, when used with the FILTER_FLAG_NO_PRIV_RANGE, would not correctly identify the un-normalized IPv6 address as being in a private range, thus bypassing the security check. This allowed an unauthenticated user to make the server issue requests to internal network addresses. The patch, identified in commit 3a0b3a05ab5f788fad4fa0af710d52510c56218e, rectifies this by adding a code block in assertPublicIp to detect and normalize these IPv4-mapped addresses to their standard IPv4 format before the filter_var validation is performed. The primary vulnerable function is Statamic\Imaging\RemoteUrlValidator::assertPublicIp, and its public-facing caller Statamic\Imaging\RemoteUrlValidator::validate would be the entry point seen during exploitation.

Vulnerable functions

Statamic\Imaging\RemoteUrlValidator::assertPublicIp

src/Imaging/RemoteUrlValidator.php

The `assertPublicIp` function was vulnerable to an SSRF bypass because it did not properly sanitize IP addresses before validation. An attacker could use an IPv4-mapped IPv6 address (e.g., `::ffff:127.0.0.1`) to refer to an internal IP address. The `filter_var` function with the `FILTER_FLAG_NO_PRIV_RANGE` flag would fail to identify this as a private address, allowing the validation to pass. The patch introduces a normalization step that converts these IPv4-mapped addresses into their standard IPv4 representation before the validation check, thus preventing the bypass.

Statamic\Imaging\RemoteUrlValidator::validate

src/Imaging/RemoteUrlValidator.php

This is the main public method of the validator class that initiates the URL validation process. It calls other internal methods, including `ensureHostResolvesToPublicIps`, which in turn calls the vulnerable `assertPublicIp` function. Therefore, this function is the entry point for triggering the vulnerability and would appear in a stack trace during exploitation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.